Delia, my best guess is that that's based on a $_GET size limit per "key" imposed by the Zen Cart base /includes/application_top.php's processing for 'contaminated' keys
The following section, from the zc156a version of that file, imposes a 43-character limit on each of the "paramsToCheck":
$paramsToCheck = array('main_page', 'cPath', 'products_id', 'language', 'currency', 'action', 'manufacturers_id', 'pID', 'pid', 'reviews_id', 'filter_id', 'zenid', 'sort', 'number_of_uploads', 'notify', 'page_holder', 'chapter', 'alpha_filter_id', 'typefilter', 'disp_order', 'id', 'key', 'music_genre_id', 'record_company_id', 'set_session_login', 'faq_item', 'edit', 'delete', 'search_in_description', 'dfrom', 'pfrom', 'dto', 'pto', 'inc_subcat', 'payment_error', 'order', 'gv_no', 'pos', 'addr', 'error', 'count', 'error_message', 'info_message', 'cID', 'page', 'credit_class_error_code');
if (!$contaminated) {
foreach($paramsToCheck as $key) {
if (isset($_GET[$key]) && !is_array($_GET[$key])) {
if (substr($_GET[$key], 0, 4) == 'http' || strstr($_GET[$key], '//')) {
$contaminated = true;
break;
}
$len = (in_array($key, array('zenid', 'error_message', 'payment_error'))) ? 255 : 43;
if (isset($_GET[$key]) && strlen($_GET[$key]) > $len) {
$contaminated = true;
break;
}
}
}
}
USU's .htaccess file sets $_GET['cPath'] to the characters following that trailing -c- ... which comprise 44 characters. Why that limit is 43 is anyone's guess.